Is CVE-2026-77104 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77104 being exploited in the wild.

How severe is CVE-2026-77104?

High severity, with a CVSS score of 7.5, published 8 September 2026.

Which products and versions are affected?

Commvault CommServe 11.36.0–11.36.122, 11.40.0–11.40.71, 11.44.0–11.44.19, 11.46.0–11.46.19.

Is there a fix for CVE-2026-77104?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77104 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77104?

Check whether you run Commvault CommServe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77104: Commvault CommServe path traversal information disclosure

CVE-2026-77104 · Severity: high · CVSS 7.5 · Published 2026-09-08

Commvault CommServe, a central management and backup component used in enterprise data protection systems, contains a path traversal vulnerability that allows attackers to access and disclose sensitive information. An attacker exploiting this flaw could read confidential files from the server, potentially exposing backup metadata, credentials, or other business-critical data without requiring authentication.

Technologies: Commvault CommServe. Vendors: Commvault.

Quick answers

Is CVE-2026-77104 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77104 being exploited in the wild.
How severe is CVE-2026-77104?: High severity, with a CVSS score of 7.5, published 8 September 2026.
Which products and versions are affected?: Commvault CommServe 11.36.0–11.36.122, 11.40.0–11.40.71, 11.44.0–11.44.19, 11.46.0–11.46.19.
Is there a fix for CVE-2026-77104?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77104 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77104?: Check whether you run Commvault CommServe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal issue in CommServe that enables information disclosure through improper input validation or file access controls. The flaw allows an attacker to manipulate file paths to access files outside intended directories. This is a network-accessible vulnerability affecting CommServe installations on Linux and Windows platforms across multiple versions. Affected versions include 11.46.0–11.46.19, 11.44.0–11.44.19, 11.40.0–11.40.71, and 11.36.0–11.36.122. Commvault has released patches: 11.46.20, 11.44.20, 11.40.72, and 11.36.123 and higher resolve the issue.

Affected products

Commvault CommServe 11.36.0–11.36.122, 11.40.0–11.40.71, 11.44.0–11.44.19, 11.46.0–11.46.19

Timeline

2026-09-08: disclosed: Vulnerability disclosed and advisory published

References

https://documentation.commvault.com/securityadvisories/CV_2026_08_6.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.